Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Lake City Employee Fired Following Ransom Payment
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
tdsan
tdsan,
 User Rank: Ninja
7/8/2019 | 4:20:01 PM
RE: Lake City Employee Fired Following Ransom Payment
I agree with you, I was thinking could there be a better way to resolve this issue.

Think about this, we have implemented software that takes an image of a 50-70GB HD (running on NVMe and USB 3.1) where we were able to image the system in about 5-8 minutes. We then took the NVMe disk with the iso for the imaging startup, then booted up the iso (started the application or in certain instances, we would leave it running) in the cloud. We then would point the software to the data iso and recreate the server using this imaging software, cloud, virtual machine or physical machine - minutes to restore) without ever leaving our desk, we pointed the ELB, F5 or Citrix Netscaler to this virtual cloud machine and we were back up and running.

For one-offs, I do think your solution worked great, but if the client is in another state, then that may be somewhat difficult; especially if they live states over (maybe FedEx would work), but it was just a thought.

T
REISEN1955
REISEN1955,
 User Rank: Ninja
7/8/2019 | 3:08:11 PM
RE: Lake City Employee Fired Following Ransom Payment
AND a very good thought - a wide range of alternative technical guidelines of course - the main thing is that a backup and restore scenario DOES WORK if well thought out and tested well in advance.  At 2am, when restoring a server, one is not THINKING right so testing allows familiarity and documentation to be compiled.  And FAR better than paying ransom.
tdsan
tdsan,
 User Rank: Ninja
7/5/2019 | 8:56:58 PM
RE: Lake City Employee Fired Following Ransom Payment
Nice, would you consider putting the server (Web, DB) in the cloud and replicate the server ever so many hours, this could be an option when performing the recovery task. Just a thought.

VMware DR Design Scheme
bwilkes8@gmail.com
[email protected],
 User Rank: Moderator
7/3/2019 | 10:53:00 AM
RE: Lake City Employee Fired Following Ransom Payment
Sweet!!!!
REISEN1955
REISEN1955,
 User Rank: Ninja
7/3/2019 | 10:32:57 AM
RE: Lake City Employee Fired Following Ransom Payment
THANKS - i know from experience.  In 2014 before moving to Georgia, I supported small and local businesses and other entities.  One 501C3 museum was hit by Cryptolocker in January - just like that, server gone and all data encrypted.  I had a dedicated system for each client with tested backup and restore protocols so I picked the Dell computer up - put it into car and drove to my client.  System had SAME NAME as server so all data instantly available when I turned server down.  Only active directory was not available of course.

I then restored data to the server offline, and in 3 hours had 98% restoration of data - only one computer lost the desktop.  NOT BAD indeed. 
bwilkes8@gmail.com
[email protected],
 User Rank: Moderator
7/3/2019 | 10:04:31 AM
RE: Lake City Employee Fired Following Ransom Payment
Having previously worked at a company where we were hit with ransonware, before I was tasked with backups, I can say you do have a vaild point.
REISEN1955
REISEN1955,
 User Rank: Ninja
7/3/2019 | 9:45:56 AM
RE: Lake City Employee Fired Following Ransom Payment
EVER notice that in every single one of the ransomware events posted on this page, NO ONE EVER use a backup and restore option.  REBUILD EVERYTHING is a waste of effort.  I suspect, though, that NOBODY HAS A BACKUP AND RESTORE PLAN in the first place. 
bwilkes8@gmail.com
[email protected],
 User Rank: Moderator
7/3/2019 | 9:41:16 AM
RE: Lake City Employee Fired Following Ransom Payment
1. Firing the Director is an interesting call.  The Director possesses the institutional knowledge necessary to facilitate a restructuring.

2. The Mayor is going to be rich once he incorporate the layers of security necessary for this to never happen again.

3. It's interesting that recovery from backup would cost more than paying the ransom.  Hopefully they're relooking their backup solution and periodical test procedures as well.
iani540
iani540,
 User Rank: Apprentice
7/2/2019 | 8:18:38 PM
Unintelligible grammar
What does "advised a more cost-approach to retrieve the key." mean? Did you mean "cost-effective approach"?  If so, what exactly did that involve? A combination of bad proof-reading and lack of information leave us with no information about who was fired, and what for.
paul.mcaninch@btlaw.com
[email protected],
 User Rank: Apprentice
7/2/2019 | 3:44:38 PM
Good Luck
Lake City mayor Stephen Witt says city manager Joe Helfenberg made the decision to terminate an employee. Helfenberg is revamping its entire IT department to overcome the incident and set up a system to ensure it doesn't happen again. 

 

I wish him a lot of luck.  If he really can "set up a system to ensure it doesn't happen again." he's going to be a rich man.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-10072
PUBLISHED: 2023-02-04
A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address this...
CVE-2018-25079
PUBLISHED: 2023-02-04
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3...
CVE-2023-0671
PUBLISHED: 2023-02-04
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-24806
PUBLISHED: 2023-02-04
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2013-10017
PUBLISHED: 2023-02-04
A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recom...